1 of 34

1

HTTP & HTTPS

Application Layer Attacks

API’s

MICHAELA JAMES

2 of 34

HTTP

HTTP headers, TCP Connection

HTTPS

Fundamentals of HTTPS, SSL/TLS Certificate

OSI MODEL

Where does HTTP, application layer attacks, and API’s fall on the OSI model?

APIs

Different types of APIs, examples

APPLICATION LAYER ATTACKS

Different types of attacks, OWASP

02

03

04

05

AGENDA

01

3 of 34

4 of 34

http://

5 of 34

Developed in 1991

Executed on two different end systems after establishing a TCP connection

Different versions, most common versions are HTTP 1.1 and HTTP 2

HTTPS

Extension of HTTP, developed in 1995

Developed for encrypting websites and protecting payment details

Executed on two different end systems after establishing a TCP connection and TLS encryption

6 of 34

What happens after the user inputs the URL?

Enters URL into web browser

TCP connection begins

Completed after DNS request

Client sends request

Returns HTTP response

Returns error

Browser sends HTTP request to server

7 of 34

�TCP Connection - 3 Way Handshake

7

Syn

Syn/Ack

Ack

Client

Server

Connection established!

8 of 34

HTTP Request

Request sent from client to access resources on the server

REQUEST LINE

Shows request method, the URL path, and the status code

HTTP HEADERS

Additional information passed between the client and server about the request

BODY

Contains data associated with the request

9 of 34

HTTP Response

Provides the client with the resource it requested

STATUS LINE

Contains the current version of HTTP, the status code, and the reason that explains the status code

HTTP HEADERS

Contains additional information that a client can use to find out more about the response and server

BODY

Contains either the resource or information about the status

10 of 34

GET

POST

PUT

DELETE

Most Common HTTP Methods

11 of 34

Request and Response Headers

12 of 34

HTTPS

13 of 34

SSL/TLS Handshake must be completed

User data is automatically encrypted; no need for direct user input

Used for shopping websites, online banking institutions

14 of 34

TLS Handshake

‘ClientHello’ message

'ServerHello’ message

Authentication

Premaster Secret

Private key used to decrypt Premaster Secret for further authentication

Session keys created

Client ready

Server is ready

Encryption complete

15 of 34

HTTP/1.1 and HTTP/2

HTTP/1.1 needs a new TCP connection for every load

HTTP/2 utilizes multiplexing

Faster, more reliable for handling large volumes of data

16 of 34

16

17 of 34

Application Layer Attacks

Designed to attack specific vulnerabilities within an application

Allows cybercriminals to gain direct access to organizations’ sensitive data

Attack methods are constantly evolving

18 of 34

Denial of Service & Distributed Denial of Service

18

19 of 34

Common Application Layer Attacks

HTTP Floods

Sloworis Attacks

BGP Hijacking

SQL Injection

19

20 of 34

Famous DDOS Attacks

20

21 of 34

Mitigating DDOS Attacks

Determining if servers are experiencing a DDOS attack can be difficult

Null-route traffic

Reverse proxy

21

To Prevent...

Overprovision bandwidth

Increase server capacity (load balancers)

Web Application Firewalls

22 of 34

Open Web Application Security Project
Dedicated to assisting security experts with web application security
Largest credible source for security resources

22

23 of 34

OWASP Top Ten Security Vulnerabilities

23

Broken Access Control

User acting outside of intended permissions; leads to unauthorized data disclosure, modification or destruction of data

Cryptographic Failure

Weak keys, re-use of compromised keys, proper encryption not enforced, invalid certificate

Injection

Attacker inputs malicious commands or queries into web applications

Insecure Design

Represents different weaknesses: permissions mismanagement, improper usage of API’s, improper storage of data

Security Misconfiguration

Web application is susceptible to attacks due to easily exploitable configuration options

Vulnerable & Outdated Components

Application is either unsupported or outdated

Identification & Authentication Failure

Occurs when web application fails to prevent brute force attacks, flaws in password recoveries, logout for inactivity

Software & Data Integrity Failures

Code and infrastructure does not protect against integrity violations

Security Logging & Monitoring Failures

Improper monitoring of security logs

Server-Side Requests

Allows an attacker to induce the server-side application to make HTTP requests to any domain of the attacker’s choosing

24 of 34

25 of 34

Application Programming Interfaces

Software intermediary that allows the server to communicate with the web

“Messenger that takes Requests”

Sends a messenger away with a message, then the messenger returns immediately with an answer!

Access Data

Mobile application or web application calls for data integration

Hide Complexity

User avoids clicking through multiple applications

Extend Functionality

Information easily accessible while staying within one application

Security

Information is sent from client to server, server sends back immediately minimizing risks of breach

Speed

Speed and efficiency regarding communication between applications increased dramatically with the development of API’s.

26 of 34

Industries that Use API’s

Financial Institutions

Retail Giants

Weather Applications

Streaming Services

27 of 34

Types of API’s

COMPOSITE

INTERNAL

API hosted only available to in-house developers

PARTNER

PUBLIC

Shared freely on the Internet

Bundles multiple communications into a single API request

API used between two business partners/organizations

28 of 34

RESTful API’s

STATELESS

All requests operate independently from one another, and each new request includes all necessary data to complete request

CACHING

UNIFORM

CLIENT-SERVER ARCHITECTURE

Both client and server function, updates, and changes independently

Caching is available for client efficiency

Representational State Transfer + Architectural Style for Applications

Call and response data is transferred in one standardized form

LAYERED SYSTEM

Complex system that incudes several layers of servers that functions behind the scenes – client is not aware

CODE ON DEMAND

Server may send code to client to add more functionality without affecting the application (ex. Client can download a program that encrypts communication with servers

*Utilizes multiple scripting languages (JSON, HTML, etc)

29 of 34

Merchant asks for Payment

Merchant offers PayPal as valid Payment

User chooses PayPal and is redirected to PayPal’s website

PayPal requests user’s login information

User inputs login info and chooses credit card

User is redirected back to merchant’s confirmation page

User confirms order

User receives correspondence from both organizations

30 of 34

SOAP API

Simple Object Access Protocol + Standardized Communication Protocol

Only XML

Used to create, retrieve, update or delete records from a server

Standardized set of procedures that MUST be followed

Built in WS-Security and ACID Compliance

Utilized for enterprise-level web services that mandate high security

Uncacheable

31 of 34

	SOAP	REST
Meaning	Simple Object Access Protocol	Representational State Transfer
Design	Standardized protocol with pre-defined rules to follow.	Architectural style with loose guidelines and recommendations.
Approach	Function-driven (data available as services, e.g.: “getUser”)	Data-driven (data available as resources, e.g. “user”).
Statefulness	Stateless by default, but it’s possible to make a SOAP API stateful.	Stateless (no server-side sessions).
Caching	API calls cannot be cached.	API calls can be cached.
Security	WS-Security with SSL support. Built-in ACID compliance.	Supports HTTPS and SSL.
Performance	Requires more bandwidth and computing power.	Requires fewer resources.
Message format	Only XML.	Plain text, HTML, XML, JSON, YAML, and others.
Transfer protocol(s)	HTTP, SMTP, UDP, and others.	Only HTTP
Recommended for	Enterprise apps, high-security apps, distributed environment, financial services, payment gateways, telecommunication services.	Public APIs for web services, mobile services, social networks.
Advantages	High security, standardized, extensibility.	Scalability, better performance, browser-friendliness, flexibility.
Disadvantages	Poorer performance, more complexity, less flexibility.	Less security, not suitable for distributed environments.

32 of 34

XML vs. JSON

32

33 of 34

HTTP

HTTPS

Application Layer Attacks

KEY TAKEAWAYS

API’s

34 of 34

ANY QUESTIONS?